Fix brace-expansion lock for npm 10 beta deploy (#70)

## Summary
- Beta deploy after #69 failed: `Cannot find module 'brace-expansion'` during `npm run build:beta`
- Root cause: `package-lock.json` linked `brace-expansion` to empty phantom paths (`minimatch/vendor/brace-expansion-compat`). npm 11 remapped them locally; deploy Node 22 / npm 10 followed the lock literally
- Declare vendored shim as a direct dependency and rewrite lock links to `vendor/brace-expansion-compat`

## Test plan
- [x] `npm ci` under Node 22.23.1 / npm 10.9.8 resolves `brace-expansion` from fork-ts-checker nested minimatch
- [x] `npx react-scripts build` with `.env.beta` succeeds
- [x] `npm audit` still 4 moderate (0 critical / 0 high)
- [ ] Redeploy `chat_web_app` beta after mergeReviewed-on: #70

llm-fe/package.json

@@ -23,6 +23,7 @@
     "axios": "^1.13.2",
     "babel-loader": "^9.2.1",
     "bootstrap": "^5.3.3",
+    "brace-expansion": "file:vendor/brace-expansion-compat",
     "chroma-js": "^3.1.2",
     "formik": "^2.4.6",
     "jwt-decode": "^4.0.0",